Extracted

• • Target

    KMSauto-setup.exe

  • Size

    3.8MB

  • MD5

    c7e2bb8d867d4f4bb484cfe674a16c55

  • SHA1

    fdd4fbd30bc2db3faf199799bb732dbf3a137a1a

  • SHA256

    727a5380cc5975839d6411d42569d834a337d139fb40f2e94e855835e2b538d6

  • SHA512

    c8596183949d7c888724374f48c202b2f96af8a32654234f746124b0a3476682ab109c7bc293a4c5a8b8e0661a56c954ab467c5d86b9b789237f86acadd596d3

  • SSDEEP

    98304:CpyfN3PlMJaE15aViYyf6L0c6veW0YDr9C3PVbiUk:SyfQJt15RY66gnZvJUk

  Score

  10^/10

  redline0215infostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2